CVE-2024-11993 MEDIUM

CVE-2024-11993

Vendor Liferay
Product Portal
Weakness CWE-79 · XSS
Published December 17, 2024
Last update March 28, 2025
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field

Key dates

02Disclosure timeline

December 17, 2024 CVE published
March 28, 2025 Record updated